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PARTY IN INTEREST 

The assignee, International Business Machines Corporation, is the real party in 
interest. 

RELATED APPEALS AND INTERFERENCES 

This is the first appeal in the present patent application. There are no related appeals 
or interferences known to the appellant or its legal representative. 

STATUS OF CLAIMS 

Claims 1-4, 6-14, and 39-63 are pending in the application. Claim 1 is an independent 
claim. Claims 2-4 and 6-14 depend from claim 1 . Claims 5 and 15-38 were previously 
canceled. Appellant herein requests cancellation of claims 39-63. All the pending claims 
stand rejected. Office action, August 28, 2007 (the "Final Office Action")- The claims herein 
appealed and argued are claims 1 and 13. 1 

SUMMARY OF AMENDMENTS 

The present application, filed December 12, 2003, presented original claims 1-38. 

In a non-final Office action of March 16, 2007, claims 1-8, and 13-15, 21, 24, and 29 
were rejected under 35 USC 102(b) as being anticipated by US 6,021,510 (Nachenberg"). 
Claims 9-12, 16-19 and 25-27 were rejected under 35 USC 103(a) as being unpatentable over 
Nachenberg in view of US 200210138554 ("Feigen"). Claim 20 was rejected under 35 USC 
103(a) as being unpatentable over Nachenberg and Feigen in view of US 2001 10005889 
("Albrecht"). Claims 22, 23, 37, and 38 were rejected under 35 USC 103(a) as being 
unpatentable over Nachenberg. The March 16, 2007 Office action asserted that claims 30-36 
teach the system or software on a storage medium associated with the method claims 

1 Arguments are not herein presented regarding all claims remaining in the present 
application. However, Appellant contends, of course, that all claims are allowable at least 
because they depend on claims for which arguments are herein presented and which Appellant 
contends are allowable. MPEP 2143.03 (citing In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 
(Fed. Cir. 1988). 

2 
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SUMMARY OF CLAIMED SUBJECT MATTER 

The present application encompasses hash operations, for example for virus scanned 
files. Upon a new scan, new hashes are computed, which includes reading files to fast 
memory. Thereafter only files are retained in fast memory selectively, responsive to file size, 
i.e., only small files are retained. Then additional operations are performed in fast memory 
for the retained files. In particular, claim 1 recites the additional operations are selected from 
i) making backup copies and ii) transferring copies of files to other systems. 

Claim 1 

Claim 1 describes a method for controlling performance of operations in relation to a 
set of resources within a data processing network. The claim includes steps, as follows: 

First step: computing a set of hash values representing a set of resources for which an 
operation has been performed; 

Second step: storing the set of hash values; 

Third step: in response to a requirement for performance of the operation, computing 
a new set of hash values representing the set of resources; 

Fourth step: comparing the new hash values with the stored hash values for the set of 
resources to identify matches between new hash values and stored hash values; 

Fifth step: determining that performance of the operation is not currently required for 
resources for which a match is identified between the respective new hash value and a stored 
hash value; 

Sixth step: performing the operation for resources for which no match is identified 
between the new hash value and any stored hash value; 

Seventh step: wherein the step of computing a new set of hash values comprises 
reading the set of resources from a first storage medium of a system in the data processing 
network into a second storage medium of the system, the second storage medium providing 
faster access than the first storage medium, 

Eighth step: wherein the computing of the new set of hash values accesses the set of 
resources read to the second storage medium, and the method further comprises: 

4 
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Ninth step: comparing each resource of the set of resources with a maximum size 
limit to identify a subset of the resources, wherein each resource of the subset is smaller than 
said size limit; and 

Tenth step: retaining said subset of resources within said second storage medium and 

Eleventh step: performing, for the subset of resources retained within said second 
storage medium, further operations on ones of the subset of resources, the further operations 
being selected from operations including: 

Twelfth step: making backup copies and transferring copies of the resources of the 
subset of resources to other systems. 

The specification of the present application provides an exemplary embodiment of the 
invention. The specification describes the method of claim 1 in terms of that embodiment. 
Specifically, regarding claim 1> see original published application, Fig. 1, paragraph 0009. 
(method for controlling performance of operations in relation to a set of resources within a 
data processing network 70); see original published application, Fig. 2, paragraph 0056 
(computing 300 a set of hash values representing a set of resources for which an operation has 
been performed); Fig. 2, paragraph 0057 (storing 220 the set of hash values); Fig.'s 3, 6, 
and 7, paragraph 0059 (in response to a requirement for performance of the operation, 
computing 300 a new set of hash values representing the set of resources); Fig.'s 3, 6, and 7, 
paragraph 0059 (comparing 3 10 the new hash values with the stored 220 hash values for the 
set of resources to identify matches between new hash values and stored hash values); Fig/s 
3, 6, and 7, paragraph 0059 (determining 340 that performance of the operation is not 
currently required for resources for which a match is identified between the respective new 
hash value and a stored hash value); Fig/s 6 and 7, paragraph 0096 (performing the operation 
for resources for which no match is identified between the new hash value and any stored hash 
value); paragraph 0084 (wherein the step of computing 300 a new set of hash values 
comprises reading the set of resources from a first storage medium of a system in the data 
processing network 70 into a second storage medium of the system, the second storage 
medium providing faster access than the first storage medium); paragraph 0084 (wherein the 
computing 300 of the new set of hash values accesses the set of resources read to the. second 
storage medium, and the method further comprises); paragraph 0084 (comparing each 

5 
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resource of the set of resources with a maximum size limit to identify a subset of the 
resources, wherein each resource of the subset is smaller than said size limit); paragraph 0084 
(retaining said subset of resources within said second storage medium); paragraph 0084 
(performing, for the subset of resources retained within said second storage medium, further 
operations on ones of the subset of resources, the further operations being selected from 
operations); paragraph 0084 (making backup copies and transferring copies of the resources of 
the subset of resources to other systems). 

Claim 13 

Claim 13 further limits claim 1, stating that at least one resource of the set of resources 
comprises a group of files. Claim 13 also further limits claim 1, reciting that the step of claim 
1, computing a set of hash values, comprises an additional step, computing a single hash value 
for the group of files. Regarding support for claim 13, see, e.g., paragraph 0013 (at least one 
resource of the set of resources comprises a group of files and the step of computing a set of 
hash values comprises computing a single hash value for the group of files). 



6 
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GROUNDS OF REJECTION 
TO BE REVIEWED ON APPEAL 

Claims 1-4, 6-8, and 13-14 stand rejected under 35 USC 103(a) as being unpatentable 
over Nachenberg, 

ARGUMENTS 

Rejection Under 35 USC 103(3*1 over Nachenberg 
Claims 1-4. 6-8, and 13-14 

Independent claim 1 and dependent claims 2-4, 6-8, and 13-14 stand rejected over 
Nachenberg, Appellant respectfully submits that the rejection is improper and herein below 
separately argues claims 1 and 13. 

The Examiner's Position 

The Examiner cites Nachenberg as the only reference and states the following 
arguments: 

Regarding claim 1: 

Nachenberg discloses a method, system and computer program product for identifying 
data processing systems within a network having a vulnerability comprising: computing a set 
of hash values representing a set of resources for which an operation has been performed 
(column 4 lines 5-8); storing the set of hash values (column 4 lines 5-8); in response to a 
requirement for performance of the operation, computing a new set of hash values 
representing the set of resources (column 4 lines 40-47); comparing the new hash values with 
the stored hash values for the set of resources to identify matches between new hash values 
and stored hash values (column 4 lines 48-63); determining that performance of the operation 
is not currently required for resources for which a match is identified between the respective 
new bash value and a stored hash value (column 4 lines 48-53); and performing the operation 
for resources for which no match is identified between the new hash value and any stored hash 
value (column 4 lines 54-63). Nachenberg also discloses wherein the step of computing a 
new set of hash values comprises reading the set of resources from a first storage medium of a 
system in the data processing network into a second storage medium, the second storage 

7 
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medium providing faster access than the first storage medium, wherein the computing of the 
new set of hash values accesses the set of resources read to the second storage medium 
(column 4 lines 29-31), and the method further comprises: comparing each resource of the set 
of resources with a maximum size limit to identify a subset of the resources, wherein each 
resource of the subset is smaller than said size limit (it is obvious that the data does not 
exceed the storage threshold (maximum size of the memory) of said second storage, this is a 
common feature of memory management), and retaining said subset of resources within said 
second storage medium (it is obvious to hold only the amount that is available in said second 
storage, Nachenburg teaches the use of sectors (column*3 line 66 to column 4 line lo), which 
are fractions of the original file). Nachenberg, however, does not disclose performing, for the 
subset of resources retained within said second storage medium, further operations on ones of 
the subset of resources, the further operations being selected from operations including 
making backup copies and transferring copies of the resources of the subset of resources to 
other systems. Making backup copies is well known in the art and it would have been 
obvious to one of ordinary skill in the art at the time of invention to make backup copies for 
System restoration in the event of a disaster such as hardware failure, system intrusion, etc. 
Therefore, it would have been obvious to one of ordinary skill in the art at the time of 
invention to backup the files after the virus scan deemed the files virus-free. 
Regarding Claim 13: 

Nachenberg discloses the method of claim 1, wherein at least one resource of the set of 
resources comprises a group of files (column 3 lines 14-15 discloses the use of Norton 
Antivirus (NAV) which contains the capability of scanning compressed files (see Norton 
Antivirus Enterprise Solution 4.0)) and the step of computing a set of hash values comprises 
computing a single hash value for the group of files (it is inherent that the invention disclosed 
by Nachenburg would use the method for scanning a file applied to scan the compressed file). 
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The Appellant's Rebuttal 

Regarding Claim 1: 

The teaching by Nachenberg and well-known facts relied upon for the rejection do not 
teach or suggest "comparing each resource of the set of resources with a maximum size limit 
to identify a subset of the resources, wherein each resource of the subset is smaller than said 
size limit" and "retaining said subset of resources within said second storage medium" and 
"performing, for the subset of resources retained within said second storage medium, further 
operations on ones of the subset of resources" and the further operations are selected from 
operations including "making backup copies and transferring copies of the resources of the 
subset of resources to other systems," as recited in claim L All the limitations of the subject 
claims must be taught or suggested by the art relied upon. MPEP 2143.03 (citing In re Royka, 
490 E.2d 98L 180 USPQ 580 (CCPA 1974); In re Wilson, 424 F.2d 1382, 1385, 165 USPQ 
494, 496 (CCPA 1970)). 

The Final Office Action asserts that it is obvious to compare each of a subset of 
resources with a maximum size limit to identify resources within said subset that are smaller 
than the size limit, since it is a common feature of memory management that data does not 
exceed a storage threshold. The Office Action further asserts that it is obvious to retain the 
subset within a second storage medium to enable further operations, arguing that it is obvious 
to hold in the second storage only an amount for which storage is available. In this 
connection, the Office Action points out that Nachenburg teaches the use of sectors (column 3 
line 66 to column 4 line 10), which are fractions of the original file. 

Applicant respectfully submits that claim 1 is patentably distinct. Claim 1 was 
amended in Reply A to specifically recite that the method further includes "comparing each 
resource of the set of resources with a maximum size limit to identify a subset of the 
resources, wherein each resource of the subset is smaller than said size limit" and the claim 
goes on to recite "retaining said subset of resources within said second storage medium." As 
the original application states, "Each of the set of resources is then compared with a 
predefined maximum size limit (such as 1 MB) to identify resources which are smaller than 
the size limit. Resources smaller than the size limit are retained within a buffer in the second 
storage medium to enable further operations to be performed without reading a further copy of 

9 
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the resource from the first storage medium." Application 10/734,501, paragraph 0084, as 
published. 

This earlier claim amendment emphasizes that, just as the specification teaches, each 
of the resources of the identified subset of resources that are read into the second storage 
medium is smaller than a size limit. That is, the claim, as amended in Reply A, states that the 
subset of resources is retained within said second storage medium and that each resource of 
the subset is smaller than the size limit. Furthermore, the claim makes it clear that there is 
more than one resource in the subset, so the size limit is not the same as the size of the space 
in the second storage medium for storing the entire subset. See, e.g., claim 1 (''retaining said 
subset of resources," where "resources" is explicitly plural). 

Thus, it is clear that the well-known fact cited by the Office Action about a storage 
medium having a maximum capacity does not teach or suggest what is claimed. This 
well-known fact establishes merely that a storage medium cannot hold more than it can hold. 
But neither this, nor the teaching by Nachenburg about sectors, teaches or suggests 
"comparing each resource of the set of resources with a maximum size limit to identify a . 
subset of the resources, wherein each resource of the subset is smaller than said size limit" 
and "retaining said subset of resources within said second storage medium," as recited m 
claim 1. 

Also, claim 1 was amended in Reply A to specifically recite that the method includes 
"performing, for the subset of resources retained within said second storage medium, further 
operations on ones of the subset of resources." 2 This earlier amendment sets out the recited 
feature as an affirmative step, to emphasize the weight that should be given to the recited 
feature. It also emphasizes that for the further operations, the subset of the resources are 
retained in the second storage medium, i.e., not just selected ones of the resources of the 
subset. Nachenburg does not teach or Suggest this feature. The claim goes on to state that the 
further operations are selected from operations including "making backup copies and 
transferring copies of the resources of the subset of resources to other systems." The Office 



2 With regard to this feature, claim 5, as originally submitted, recited "retaining . . . resources 
within said second storage medium to enable further operations." 

10 
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Action merely replies that all this would have been obvious because it was known to make 
backup copies. 

To reiterate the above, the specification states that in an embodiment: 

A single read of a resource from a relatively slow-access storage medium (such 
as a hard disk or tape storage) may be used for multiple purposes including 
computing hash values and performing additional operations such as making 
backup copies or txansfening copies of resources to other systems. In one such 
embodiment, the step of computing a new set of hash values comprises reading 
the set of resources from a first storage medium (such as disk storage) into a 
second storage medium (such as RAM) which provides faster access than the 
first storage medium, and computing the set of hash values. Each of the set of 
resources is then compared with a predefined maximum size limit (such as 1 
MB) to identify resources which are smaller than the size limit. Resources 
smaller than the size limit are retained within a buffer in the second storage 
medium to enable further operations to be performed without reading a further 
copy of the resource from the first storage medium. 

Application 10/734,501, paragraph 0084, as published. Claim 1, accordingly, recites 

"comparing each resource of the set of resources with a maximum size limit to identify a 

subset of the resources, wherein each resource of the subset is smaller than said size limit' ' 

and "retaining said subset of resources within said second storage medium" and "performing, 

for the subset of resources retained within said second storage medium, further operations on 

ones of the subset of resources" and the further operations are selected from operations 

including "making backup copies and transferring copies of the resources of the subset of 

resources to other systems." 

All the limitations of the subject claims must be taught or suggested by the art relied 

upon, MPEP 2143.03 (citing In re Royka, 490 F.2d 981, 180 USPQ 580 (CCPA 1974); In re 

Wilson ; 424 R2d 1382, 1385, 165 USPQ 494, 496 (CCPA 1970)). However, the only 

specific reference offered by the Office Action with regard to any of the claim language 

recited in the paragraph immediately above is the use of sectors in Nachenberg, which may 

contain fractions of files. The Office Action offers no explanation of the significance of this 

teaching by Nachenberg, and merely argues that the claim language recited in the paragraph 

immediately above would have been obvious because of that teaching by Nachenberg about 

sectors and because it was known that a storage medium cannot hold more than it can hold 

11 
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and it was known to make back up copies. This teaching by Nachenberg and these 
well-known facts do not teach or suggest all the limitations of the subject claims. 

Regarding Claim 13 

The Final Office action asserts that because Nachenberg, column 3, lines 14-15, 
discloses the use of Norton Antivirus and because, the Office action asserts, Norton Antivirus 
Enterprise Solution 4. 0 has a capability for "scanning compressed files," and asserts that . 
Nachenberg, therefore, at least inherently discloses at least one resource of the set of resources 
comprises a group of files and that a single hash value is computed for the group of files. 

Applicant respectfully disagrees. All the limitations of the subject claims must be 
taught or suggested by the art relied upon. MPEP 2 143.03 (citing In re Royka, 490 F.2d 98 1 , 
180 USPQ 580 (CCPA 1974); In re Wilson, 424 F.2d 1382, 1385, 165 USPQ 494, 496 
(CCPA 1970)). For at least two reasons "scanning compressed files" does not teach or 
suggest what is recited in claim 13, namely, "computing a single hash value for a group of 
files." Firstly, scanning is not the same as computing a hash. Secondly, even if scanning does 
involve computing a hash, the statement "scanning compressed files" does not mean, and the 
reference does not elsewhere teach or suggest, "computing a single hash value for a group of 
files." For these reasons, the rejection is improper. 
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For the above reasons, Appellant contends the invention defined in independent claims 
8 and 15 is patentably distinct and that dependent claims 10-14 and 16-20 are allowable at 
least because they depend upon respectively allowable independent claims 8 or 15. In 
addition, Appellant contends that the inventions defined in dependent claims 13 and 20 are 
also further patentably distinct for the above reasons. Appellant requests that the Board grant 
allowance and prompt passage of the application to issuance. 



Anthony V,S. EnglMd 
Registration No. 35,129 
Attorney of Record for 
IBM Corporation 
Telephone: 512-477-7165 
a@aengland.com 



Attachments: Claims Appendix, Evidence Appendix, Related Proceedings Appendix 



Respectfully submitted, 
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APPENDIX "AA" CLAIMS 

1. (previously presented) A method for controlling performance of operations in 
relation to a set of resources within a data processing network, the operations including a first 
operation, the method comprising the steps of: 

computing a set of hash values representing a set of resources for which an operation 
has been performed; 

storing the set of hash values; 

in response to a requirement for performance of the operation, computing a new set of 
hash values representing the set of resources; 

comparing the new hash values with the stored hash values for the set of resources to 
identify matches between new hash values and stored hash values; 

determining that performance of the operation is not currently required for resources 
for which a match is identified between the respective new hash value and a stored hash 
value; performing the operation for resources for which no match is identified between the 
new hash value and any stored hash value; 

wherein the step of computing a new set of hash values comprises: 

reading the set of resources from a first storage medium of a system in the data . 
processing network into a second storage medium of the system, the second storage medium 
providing faster access than the first storage medium, wherein the computing of the new set of 
hash values accesses the set of resources read to the second storage medium and the method 
further comprises: 

comparing each resource of the set of resources with a maximum size limit to identify 
a subset of the resources, wherein each resource of the subset is smaller than said size limit; 
and 

retaining said subset of resources within said second storage medium and 
performing, for the subset of resources retained within said second storage medium, 

further operations on ones of the subset of resources, the further operations being selected 

from operations including: 

making backup copies and transferring copies of the resources of the subset of 

resources to other systems. 
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APPENDIX "AA" CLAIMS 

2. (previously presented) The method of claim 1, wherein the first operation comprises 
scanning the resources to identify computer viruses. 

3. (previously presented) The method of claim 1, wherein the first operation comprises 
making a backup copy of the resources. 

4. (original) The method of claim 1, for controlling performance of virus scanning and 
backup copy operations in relation to a set of resources within a data processing network, the 
method comprising: 

using said identification of a match between a respective new hash value and a stored 
hash value for a resource, resulting from a single comparison of new and stored hash values, 
to determine that neither virus scanning nor backup copy operations are currently required for 
the resource. 

5. (canceled) 

6. (previously presented) The method of claim 1, wherein the first operation comprises 
transferring a resource across a low bandwidth communication channel. 

7. (original) The method of claim 1, wherein the steps of computing hash values 
comprise: 

applying a secure hash function to a bit pattern representing a resource, for each of a 
set of resources. 

8. (original) The method of claim 7, wherein the set of resources for which hash values 
are computed for a data processing system comprises the set of all files of executable file 
types on the system. 

2 
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APPENDIX "AA" CLAIMS 

9. (original) The method of claim 1> wherein the set of resources are distributed across 
a plurality of data processing systems within the network and the steps of storing the set of 
hash values and comparing the new hash values with the stored hash values are performed at a 
first data processing system within the network for the set of resources distributed across the 
plurality of data processing systems* 

10. (original) The method of claim 9, wherein the steps of computing hash values for a 
resource are performed at a respective one of the plurality of data processing systems at which 
the resource is stored, the method further comprising sending the computed hash values to 
said first data processing system. 

11. (previously presented) The method of claim 9, further comprising the step of 
sending, to each data processing system storing a resource for which it is determined that 
performance of the first operation is not currently required > an indication that performance of 
the first operation is not currently required for the resource. 

12. (previously presented) The method of claim 9, wherein the step of performing the 
first operation is performed at the first data processing system and the result of performing the 
first operation is communicated to each of the plurality of data processing systems storing a 
resource for which the first operation is required. 

13. (original) The method of claim 1, wherein at least one resource of the set of 
resources comprises a group of files and the step of computing a set of hash values comprises 
computing a single hash value for the.group of files. 

14. (original) The method of claim 13, wherein at least one resource of the set of 
resources is a compressed group of files. 

15-63. (canceled) 
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APPENDIX "BB" EVIDENCE 

NONE. 
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APPENDIX <<CC" RELATED PROCEEDINGS 

NONE. 
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